Security policy

Last updated September 29, 2026

This policy describes how Mint Labs protects the data Mint Translate handles on behalf of merchants. It applies to everyone at Mint Labs with access to our systems.

Data loss prevention

• We keep as little data as possible. The app never reads customer or order records. Translations are saved in the merchant's Shopify store; our database holds settings, progress and fingerprints (hashes) of translations, not copies of the text.
• Our database is Cloudflare D1: encrypted at rest, with automatic point-in-time recovery so it can be restored to any minute in the retention window.
• All traffic uses HTTPS (TLS). Production and development use separate databases; development never uses real merchant data.
• Webhooks are verified with Shopify HMAC signatures and admin requests with Shopify session tokens; unsigned requests are rejected.
• Text sent for translation goes to Cloudflare Workers AI, which does not use it to train models or share it with other customers, and is not stored there.

Access control

• Only authorised Mint Labs personnel who need it to run and support the app can access production systems.
• The app requests read access to store content and write access only to translations and languages — nothing else in the store.
• Access is removed immediately when it is no longer needed.

Passwords and authentication

• Every account with access to production (hosting and Shopify Partner) uses a strong, unique password stored in a password manager.
• Two-factor authentication is required on all of those accounts.
• API secrets are stored as encrypted environment secrets, never in source code, and are rotated after any suspected exposure.

Logging

• Requests and background jobs are logged with a timestamp by our hosting provider's logs. Logs contain job IDs, counts and error codes — never store text or personal data.
• Logs are reviewed when investigating errors or suspected incidents.

Security incident response

1. Report. Anyone can report a suspected issue to support@stickermint.com. We acknowledge reports within one business day.
2. Contain. We stop the exposure first: pause background jobs, revoke and rotate keys and access tokens, and block abusive traffic.
3. Investigate. We use request logs and database history to find what happened, which shops and data were affected, and when.
4. Notify. If personal data was affected, we notify affected merchants without undue delay and within 72 hours of confirming the incident, and tell Shopify where required, with what happened and what we are doing about it.
5. Recover. We fix the root cause and, if needed, restore data from point-in-time recovery.
6. Review. We record each incident and the lessons learned, and update this policy.

Contact

Mint Labs — support@stickermint.com